sneakoscope 8.1.2 → 8.2.0

package/dist/core/codex-lb/provider-credentials/validation-store.js

@@ -0,0 +1,137 @@
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { writeJsonAtomic } from '../../fsx.js';
+import { providerCode, unique } from './runtime.js';
+import { resolveAllProviderCredentials, resolveProviderCredential } from './resolution.js';
+import { withFileLock } from '../../locks/file-lock.js';
+import { withProviderCredentialLock } from './locks.js';
+export function providerCredentialValidationPath(home = process.env.HOME || os.homedir()) {
+    return path.join(path.resolve(home), '.codex', 'sks', 'sks-bridge-provider-validation.json');
+}
+export async function resolveAllProviderCredentialsWithValidation(options = {}) {
+    const home = options.home || process.env.HOME || os.homedir();
+    const raw = await resolveAllProviderCredentials({
+        codexLb: { home, ...(options.codexLb || {}) },
+        openrouter: { home, ...(options.openrouter || {}) }
+    });
+    const store = await readProviderCredentialValidationStore(options.validationPath || providerCredentialValidationPath(home));
+    const validationFor = (providerId) => {
+        const credential = raw[providerId];
+        const record = store.providers[providerId];
+        if (!record
+            || !credential.fingerprint
+            || record.credential_fingerprint !== credential.fingerprint
+            || record.endpoint_url !== String(credential.endpoint_url || '')) {
+            return null;
+        }
+        return {
+            state: record.state,
+            checked_at: record.checked_at,
+            blockers: record.blockers,
+            warnings: record.warnings
+        };
+    };
+    const [codexLb, openrouter] = await Promise.all([
+        resolveProviderCredential('codex-lb', {
+            home,
+            ...(options.codexLb || {}),
+            validation: validationFor('codex-lb')
+        }),
+        resolveProviderCredential('openrouter', {
+            home,
+            ...(options.openrouter || {}),
+            validation: validationFor('openrouter')
+        })
+    ]);
+    return { 'codex-lb': codexLb, openrouter };
+}
+export async function recordProviderCredentialValidation(input) {
+    if (!input.credential.fingerprint || !input.credential.endpoint_url) {
+        throw new Error(`${providerCode(input.provider_id)}_credential_validation_binding_missing`);
+    }
+    const home = input.home || process.env.HOME || os.homedir();
+    const file = input.validationPath || providerCredentialValidationPath(home);
+    return withProviderCredentialLock(home, input.provider_id, () => withFileLock({
+        lockPath: `${path.resolve(file)}.lock`, timeoutMs: 10_000, staleMs: 60_000,
+    }, async () => {
+        if (input.resolveCurrentCredential) {
+            const currentCredential = await input.resolveCurrentCredential();
+            if (currentCredential.fingerprint !== input.credential.fingerprint
+                || currentCredential.endpoint_url !== input.credential.endpoint_url) {
+                throw new Error(`${providerCode(input.provider_id)}_credential_validation_conflict`);
+            }
+        }
+        const current = await readProviderCredentialValidationStore(file);
+        const next = {
+            schema: 'sks.provider-credential-validation-store.v1',
+            providers: {
+                ...current.providers,
+                [input.provider_id]: {
+                    credential_fingerprint: input.credential.fingerprint,
+                    endpoint_url: input.credential.endpoint_url,
+                    state: input.state,
+                    checked_at: input.checked_at || new Date().toISOString(),
+                    blockers: unique(input.blockers || []),
+                    warnings: unique(input.warnings || [])
+                }
+            }
+        };
+        await writeJsonAtomic(file, next, { mode: 0o600 });
+        await fs.chmod(file, 0o600);
+        return next;
+    }));
+}
+export async function readProviderCredentialValidationStore(file) {
+    const empty = {
+        schema: 'sks.provider-credential-validation-store.v1',
+        providers: {}
+    };
+    const stat = await fs.lstat(file).catch(() => null);
+    if (!stat)
+        return empty;
+    const expectedUid = typeof process.getuid === 'function' ? process.getuid() : null;
+    if (!stat.isFile()
+        || stat.isSymbolicLink()
+        || (expectedUid !== null && stat.uid !== expectedUid)
+        || (process.platform !== 'win32' && (stat.mode & 0o777) !== 0o600)) {
+        throw new Error('provider_credential_validation_store_insecure');
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(await fs.readFile(file, 'utf8'));
+    }
+    catch {
+        throw new Error('provider_credential_validation_store_invalid');
+    }
+    if (!isValidationStore(parsed))
+        throw new Error('provider_credential_validation_store_invalid');
+    return parsed;
+}
+function isValidationStore(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return false;
+    const row = value;
+    if (row.schema !== 'sks.provider-credential-validation-store.v1'
+        || !row.providers
+        || typeof row.providers !== 'object'
+        || Array.isArray(row.providers))
+        return false;
+    return Object.entries(row.providers).every(([providerId, entry]) => {
+        if (providerId !== 'codex-lb' && providerId !== 'openrouter')
+            return false;
+        if (!entry || typeof entry !== 'object' || Array.isArray(entry))
+            return false;
+        const record = entry;
+        return typeof record.credential_fingerprint === 'string'
+            && /^[a-f0-9]{16}$/.test(record.credential_fingerprint)
+            && typeof record.endpoint_url === 'string'
+            && ['ready', 'rejected', 'unavailable', 'stale'].includes(String(record.state || ''))
+            && typeof record.checked_at === 'string'
+            && Number.isFinite(Date.parse(record.checked_at))
+            && Array.isArray(record.blockers)
+            && record.blockers.every((item) => typeof item === 'string')
+            && Array.isArray(record.warnings)
+            && record.warnings.every((item) => typeof item === 'string');
+    });
+}

package/dist/core/codex-lb/provider-credentials.js

@@ -0,0 +1,5 @@
+export { configureProviderCredential } from './provider-credentials/configuration.js';
+export { removeProviderCredential } from './provider-credentials/removal.js';
+export { resolveAllProviderCredentials, resolveProviderCredential } from './provider-credentials/resolution.js';
+export { providerCredentialStatus } from './provider-credentials/runtime.js';
+export { providerCredentialValidationPath, readProviderCredentialValidationStore, recordProviderCredentialValidation, resolveAllProviderCredentialsWithValidation } from './provider-credentials/validation-store.js';

package/dist/core/codex-lb/provider-registry.js

@@ -0,0 +1,323 @@
+import crypto from 'node:crypto';
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { providerCredentialStatus, resolveAllProviderCredentials } from './provider-credentials.js';
+import { codexLbBaseUrlSecurityBlocker } from './codex-lb-env.js';
+import { writeJsonAtomic } from '../fsx.js';
+import { withFileLock } from '../locks/file-lock.js';
+export const BRIDGE_PROVIDER_REGISTRY_SCHEMA = 'sks.bridge-provider-registry.v1';
+export const BRIDGE_PROVIDER_REGISTRY_FILENAME = 'sks-bridge-provider-registry.json';
+export const OPENROUTER_ALLOWED_ORIGIN = 'https://openrouter.ai';
+export function bridgeProviderRegistryPath(home = process.env.HOME || os.homedir()) {
+    return path.join(path.resolve(home), '.codex', 'sks', BRIDGE_PROVIDER_REGISTRY_FILENAME);
+}
+export async function resolveBridgeProviderRegistry(options = {}) {
+    const credentials = options.credentials || await resolveAllProviderCredentials(options.credentialOptions || {});
+    const file = options.registryPath || bridgeProviderRegistryPath(options.home);
+    const read = options.storedRegistry
+        ? { registry: options.storedRegistry, blockers: [] }
+        : await readStoredBridgeProviderRegistry(file);
+    const stored = read.registry || defaultStoredRegistry(credentials);
+    const profiles = {
+        'codex-lb': resolveProfile('codex-lb', stored.profiles['codex-lb'], credentials['codex-lb']),
+        openrouter: resolveProfile('openrouter', stored.profiles.openrouter, credentials.openrouter)
+    };
+    return {
+        schema: BRIDGE_PROVIDER_REGISTRY_SCHEMA,
+        generation: digest({
+            profiles: Object.fromEntries(Object.entries(profiles).map(([provider, profile]) => [provider, {
+                    enabled: profile.enabled,
+                    profile_generation: profile.profile_generation
+                }]))
+        }),
+        profiles,
+        blockers: unique([
+            ...read.blockers,
+            ...profiles['codex-lb'].blockers,
+            ...profiles.openrouter.blockers
+        ]),
+        warnings: unique([
+            ...profiles['codex-lb'].warnings,
+            ...profiles.openrouter.warnings
+        ])
+    };
+}
+export async function loadStoredBridgeProviderRegistry(options = {}) {
+    const file = options.registryPath || bridgeProviderRegistryPath(options.home);
+    const read = await readStoredBridgeProviderRegistry(file);
+    return { path: file, registry: read.registry, blockers: read.blockers };
+}
+export function buildStoredBridgeProviderRegistry(input) {
+    const base = defaultStoredRegistry(input.credentials);
+    const profiles = { ...base.profiles };
+    for (const providerId of ['codex-lb', 'openrouter']) {
+        const override = input.overrides?.[providerId];
+        if (!override?.present)
+            continue;
+        const endpoint = normalizeEndpoint(override.endpoint_url || base.profiles[providerId].endpoint_url || '');
+        const origin = endpointOrigin(endpoint);
+        const authTransport = override.auth_transport || defaultAuthTransport(providerId);
+        const blocker = providerEndpointSecurityBlocker(providerId, endpoint, origin ? [origin] : []);
+        if (blocker)
+            throw new Error(blocker);
+        profiles[providerId] = {
+            enabled: override.enabled,
+            endpoint_url: endpoint,
+            allowed_origins: origin ? [origin] : [],
+            auth_transport: authTransport
+        };
+    }
+    return { schema: BRIDGE_PROVIDER_REGISTRY_SCHEMA, profiles };
+}
+export function serializeStoredBridgeProviderRegistry(registry) {
+    if (!isStoredRegistry(registry))
+        throw new Error('provider_registry_schema_invalid');
+    return `${JSON.stringify(registry, null, 2)}\n`;
+}
+export async function setBridgeProviderEnabled(input) {
+    const credentials = input.credentials || await resolveAllProviderCredentials(input.credentialOptions || {});
+    const file = input.registryPath || bridgeProviderRegistryPath(input.home);
+    return withFileLock(registryLockOptions(file), async () => {
+        const read = await readStoredBridgeProviderRegistry(file);
+        if (read.blockers.length > 0)
+            throw new Error(read.blockers[0]);
+        const current = read.registry || defaultStoredRegistry(credentials);
+        const next = {
+            schema: BRIDGE_PROVIDER_REGISTRY_SCHEMA,
+            profiles: {
+                ...current.profiles,
+                [input.provider_id]: {
+                    ...current.profiles[input.provider_id],
+                    enabled: input.enabled
+                }
+            }
+        };
+        await writeJsonAtomic(file, next, { mode: 0o600 });
+        return resolveBridgeProviderRegistry({
+            ...(input.home ? { home: input.home } : {}),
+            registryPath: file,
+            credentials
+        });
+    });
+}
+export async function configureBridgeProviderProfile(input) {
+    const credentials = input.credentials || await resolveAllProviderCredentials();
+    const endpoint = normalizeEndpoint(input.endpoint_url);
+    const origin = endpointOrigin(endpoint) || '';
+    const blocker = providerEndpointSecurityBlocker(input.provider_id, endpoint, input.allowed_origins || [origin]);
+    if (blocker)
+        throw new Error(blocker);
+    const file = input.registryPath || bridgeProviderRegistryPath(input.home);
+    return withFileLock(registryLockOptions(file), async () => {
+        const read = await readStoredBridgeProviderRegistry(file);
+        if (read.blockers.length > 0)
+            throw new Error(read.blockers[0]);
+        const current = read.registry || defaultStoredRegistry(credentials);
+        const nextProfile = {
+            enabled: input.enabled ?? current.profiles[input.provider_id].enabled,
+            endpoint_url: endpoint,
+            allowed_origins: normalizeOrigins(input.allowed_origins || [origin]),
+            auth_transport: input.auth_transport || defaultAuthTransport(input.provider_id)
+        };
+        const next = {
+            schema: BRIDGE_PROVIDER_REGISTRY_SCHEMA,
+            profiles: { ...current.profiles, [input.provider_id]: nextProfile }
+        };
+        await writeJsonAtomic(file, next, { mode: 0o600 });
+        return resolveBridgeProviderRegistry({
+            ...(input.home ? { home: input.home } : {}),
+            registryPath: file,
+            credentials
+        });
+    });
+}
+function registryLockOptions(file) {
+    return { lockPath: `${path.resolve(file)}.lock`, timeoutMs: 10_000, staleMs: 60_000 };
+}
+export function providerEndpointSecurityBlocker(providerId, endpointUrl, allowedOrigins) {
+    if (!endpointUrl)
+        return `${providerCode(providerId)}_endpoint_missing`;
+    try {
+        const url = new URL(endpointUrl);
+        if (url.username || url.password || url.search || url.hash)
+            return 'provider_endpoint_components_forbidden';
+        const normalizedAllowed = normalizeOrigins(allowedOrigins);
+        if (!normalizedAllowed.includes(url.origin))
+            return 'provider_endpoint_origin_not_allowlisted';
+        if (providerId === 'openrouter') {
+            if (url.protocol !== 'https:' || url.origin !== OPENROUTER_ALLOWED_ORIGIN) {
+                return 'openrouter_endpoint_origin_not_allowlisted';
+            }
+            return null;
+        }
+        return codexLbBaseUrlSecurityBlocker(endpointUrl);
+    }
+    catch {
+        return 'provider_endpoint_invalid';
+    }
+}
+async function readStoredBridgeProviderRegistry(file) {
+    const stat = await fs.lstat(file).catch(() => null);
+    if (!stat)
+        return { registry: null, blockers: [] };
+    if (!stat.isFile() || stat.isSymbolicLink()) {
+        return { registry: null, blockers: ['provider_registry_not_regular_file'] };
+    }
+    const expectedUid = typeof process.getuid === 'function' ? process.getuid() : null;
+    if (expectedUid !== null && stat.uid !== expectedUid) {
+        return { registry: null, blockers: ['provider_registry_owner_mismatch'] };
+    }
+    if (process.platform !== 'win32' && (stat.mode & 0o777) !== 0o600) {
+        return { registry: null, blockers: ['provider_registry_mode_insecure'] };
+    }
+    try {
+        const value = JSON.parse(await fs.readFile(file, 'utf8'));
+        if (!isStoredRegistry(value))
+            return { registry: null, blockers: ['provider_registry_schema_invalid'] };
+        return { registry: value, blockers: [] };
+    }
+    catch {
+        return { registry: null, blockers: ['provider_registry_json_invalid'] };
+    }
+}
+function defaultStoredRegistry(credentials) {
+    const codexEndpoint = credentials['codex-lb'].endpoint_url;
+    const openRouterEndpoint = credentials.openrouter.endpoint_url || 'https://openrouter.ai/api/v1';
+    return {
+        schema: BRIDGE_PROVIDER_REGISTRY_SCHEMA,
+        profiles: {
+            'codex-lb': defaultProfile('codex-lb', codexEndpoint, credentials['codex-lb'].state !== 'not_configured'),
+            openrouter: defaultProfile('openrouter', openRouterEndpoint, credentials.openrouter.state !== 'not_configured')
+        }
+    };
+}
+function defaultProfile(providerId, endpointUrl, enabled) {
+    const endpoint = normalizeEndpoint(endpointUrl || '');
+    const origin = endpointOrigin(endpoint);
+    return {
+        enabled,
+        endpoint_url: endpoint,
+        allowed_origins: origin ? [origin] : [],
+        auth_transport: defaultAuthTransport(providerId)
+    };
+}
+function resolveProfile(providerId, stored, credential) {
+    const endpoint = normalizeEndpoint(stored.endpoint_url || credential.endpoint_url || '');
+    const endpointBlocker = providerEndpointSecurityBlocker(providerId, endpoint, stored.allowed_origins);
+    const credentialStatus = providerCredentialStatus(credential);
+    const blockers = unique([
+        ...(endpointBlocker ? [endpointBlocker] : []),
+        ...credentialStatus.blockers
+    ]);
+    const state = !stored.enabled
+        ? 'disabled'
+        : blockers.length > 0 && credentialStatus.state !== 'not_configured'
+            ? 'blocked'
+            : credentialStatus.state === 'ready'
+                ? 'ready'
+                : credentialStatus.state === 'not_configured'
+                    ? 'not_configured'
+                    : 'configured_unverified';
+    const origin = endpointOrigin(endpoint);
+    const profileGeneration = digest({
+        provider_id: providerId,
+        enabled: stored.enabled,
+        credential_fingerprint: credentialStatus.fingerprint,
+        credential_state: credentialStatus.state,
+        endpoint,
+        allowed_origins: [...stored.allowed_origins].sort(),
+        auth_transport: stored.auth_transport
+    });
+    const endpointStatus = {
+        configured: Boolean(endpoint) && !endpointBlocker,
+        origin,
+        origin_redacted: origin,
+        allowed_origins: [...stored.allowed_origins].sort(),
+        auth_transport: stored.auth_transport,
+        blockers: endpointBlocker ? [endpointBlocker] : []
+    };
+    Object.defineProperty(endpointStatus, 'url', {
+        value: endpoint,
+        enumerable: false,
+        configurable: false,
+        writable: false
+    });
+    return {
+        provider_id: providerId,
+        enabled: stored.enabled,
+        profile_generation: profileGeneration,
+        credential: credentialStatus,
+        endpoint: endpointStatus,
+        state,
+        blockers,
+        warnings: [...credentialStatus.warnings]
+    };
+}
+function isStoredRegistry(value) {
+    if (value.schema !== BRIDGE_PROVIDER_REGISTRY_SCHEMA || !value.profiles)
+        return false;
+    return ['codex-lb', 'openrouter'].every((providerId) => {
+        const profile = value.profiles?.[providerId];
+        return Boolean(profile
+            && typeof profile.enabled === 'boolean'
+            && (profile.endpoint_url === null || typeof profile.endpoint_url === 'string')
+            && Array.isArray(profile.allowed_origins)
+            && profile.allowed_origins.every((origin) => typeof origin === 'string')
+            && ['authorization-bearer', 'x-codex-lb-api-key', 'openrouter-bearer'].includes(profile.auth_transport));
+    });
+}
+function defaultAuthTransport(providerId) {
+    return providerId === 'openrouter' ? 'openrouter-bearer' : 'authorization-bearer';
+}
+function normalizeEndpoint(value) {
+    const text = String(value || '').trim().replace(/\/+$/, '');
+    if (!text)
+        return null;
+    try {
+        return new URL(text).toString().replace(/\/+$/, '');
+    }
+    catch {
+        return text;
+    }
+}
+function endpointOrigin(endpoint) {
+    if (!endpoint)
+        return null;
+    try {
+        return new URL(endpoint).origin;
+    }
+    catch {
+        return null;
+    }
+}
+function normalizeOrigins(values) {
+    return unique(values.map((value) => {
+        try {
+            return new URL(value).origin;
+        }
+        catch {
+            return '';
+        }
+    })).sort();
+}
+function providerCode(providerId) {
+    return providerId === 'codex-lb' ? 'codex_lb' : 'openrouter';
+}
+function digest(value) {
+    return crypto.createHash('sha256').update(stableStringify(value)).digest('hex');
+}
+function stableStringify(value) {
+    if (Array.isArray(value))
+        return `[${value.map(stableStringify).join(',')}]`;
+    if (value && typeof value === 'object') {
+        return `{${Object.entries(value)
+            .sort(([left], [right]) => left.localeCompare(right))
+            .map(([key, entry]) => `${JSON.stringify(key)}:${stableStringify(entry)}`)
+            .join(',')}}`;
+    }
+    return JSON.stringify(value) ?? 'null';
+}
+function unique(values) {
+    return [...new Set(values.map((value) => String(value || '').trim()).filter(Boolean))];
+}

package/dist/core/codex-lb/provider-route-policy.js

@@ -0,0 +1,118 @@
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { canonicalizeBridgeModelId, normalizeBridgeUpstreamModelId, sha256Stable } from './route-index.js';
+import { writeJsonAtomic } from '../fsx.js';
+import { withFileLock } from '../locks/file-lock.js';
+export const BRIDGE_ROUTE_POLICY_FILENAME = 'sks-bridge-route-policy.json';
+export function bridgeRoutePolicyPath(codexHome = process.env.CODEX_HOME || path.join(os.homedir(), '.codex')) {
+    return path.join(path.resolve(codexHome), 'sks', BRIDGE_ROUTE_POLICY_FILENAME);
+}
+export function buildBridgeRoutingPolicy(input) {
+    const routes = canonicalRoutes(input.route_index.routes);
+    const semantic = {
+        default_provider_id: input.default_provider_id ?? null,
+        fallback: 'none',
+        model_routes: routes,
+        catalog_generation: input.catalog_generation
+    };
+    return {
+        schema: 'sks.bridge-routing-policy.v1',
+        ...semantic,
+        policy_generation: sha256Stable(semantic),
+        changed_at: input.changed_at || new Date().toISOString()
+    };
+}
+export function setBridgeRoutingDefault(policy, providerId, changedAt) {
+    const semantic = {
+        default_provider_id: providerId,
+        fallback: 'none',
+        model_routes: canonicalRoutes(policy.model_routes),
+        catalog_generation: policy.catalog_generation
+    };
+    return {
+        schema: 'sks.bridge-routing-policy.v1',
+        ...semantic,
+        policy_generation: sha256Stable(semantic),
+        changed_at: changedAt || new Date().toISOString()
+    };
+}
+export function validateBridgeRoutingPolicy(policy, routeIndex) {
+    const blockers = [];
+    if (policy.schema !== 'sks.bridge-routing-policy.v1')
+        blockers.push('bridge_route_policy_schema_invalid');
+    if (policy.fallback !== 'none')
+        blockers.push('bridge_route_policy_fallback_forbidden');
+    if (!policy.catalog_generation)
+        blockers.push('bridge_route_policy_catalog_generation_missing');
+    const canonical = canonicalRoutes(policy.model_routes);
+    const semantic = {
+        default_provider_id: policy.default_provider_id,
+        fallback: 'none',
+        model_routes: canonical,
+        catalog_generation: policy.catalog_generation
+    };
+    if (sha256Stable(semantic) !== policy.policy_generation)
+        blockers.push('bridge_route_policy_generation_invalid');
+    if (Object.keys(canonical).length !== Object.keys(policy.model_routes).length)
+        blockers.push('bridge_route_policy_model_invalid');
+    if (routeIndex) {
+        for (const [model, target] of Object.entries(canonical)) {
+            const indexed = routeIndex.routes[model];
+            if (!indexed || !sameTarget(indexed, target))
+                blockers.push('bridge_route_policy_route_index_mismatch');
+        }
+    }
+    return unique(blockers);
+}
+export async function writeBridgeRoutingPolicy(file, policy, routeIndex) {
+    const blockers = validateBridgeRoutingPolicy(policy, routeIndex);
+    if (blockers.length > 0)
+        throw new Error(blockers[0]);
+    await withFileLock({
+        lockPath: `${path.resolve(file)}.lock`,
+        timeoutMs: 10_000,
+        staleMs: 60_000
+    }, () => writeJsonAtomic(file, policy, { mode: 0o600 }));
+}
+export async function readBridgeRoutingPolicy(file) {
+    const stat = await fs.lstat(file).catch(() => null);
+    if (!stat)
+        return { policy: null, blockers: ['bridge_route_policy_missing'] };
+    if (!stat.isFile() || stat.isSymbolicLink())
+        return { policy: null, blockers: ['bridge_route_policy_not_regular_file'] };
+    const expectedUid = typeof process.getuid === 'function' ? process.getuid() : null;
+    if (expectedUid !== null && stat.uid !== expectedUid)
+        return { policy: null, blockers: ['bridge_route_policy_owner_mismatch'] };
+    if (process.platform !== 'win32' && (stat.mode & 0o777) !== 0o600) {
+        return { policy: null, blockers: ['bridge_route_policy_mode_insecure'] };
+    }
+    try {
+        const policy = JSON.parse(await fs.readFile(file, 'utf8'));
+        const blockers = validateBridgeRoutingPolicy(policy);
+        return blockers.length > 0 ? { policy: null, blockers } : { policy, blockers: [] };
+    }
+    catch {
+        return { policy: null, blockers: ['bridge_route_policy_json_invalid'] };
+    }
+}
+function canonicalRoutes(routes) {
+    const rows = [];
+    for (const [model, target] of Object.entries(routes)) {
+        const canonicalModel = canonicalizeBridgeModelId(model);
+        const upstreamModel = normalizeBridgeUpstreamModelId(target.upstream_model);
+        if (!canonicalModel || !upstreamModel || !isProviderId(target.provider_id))
+            continue;
+        rows.push([canonicalModel, { provider_id: target.provider_id, upstream_model: upstreamModel }]);
+    }
+    return Object.fromEntries(rows.sort(([left], [right]) => left.localeCompare(right)));
+}
+function isProviderId(value) {
+    return value === 'codex-lb' || value === 'openrouter';
+}
+function sameTarget(left, right) {
+    return left.provider_id === right.provider_id && left.upstream_model === right.upstream_model;
+}
+function unique(values) {
+    return [...new Set(values)];
+}